Context Navigation

source: trunk/src/sh_gpg.c@ 131

Last change on this file since 131 was 131, checked in by rainer, 17 years ago
Use thread-safe libc functions.
File size: 31.5 KB

Line
1	/* SAMHAIN file system integrity testing */
2	/* Copyright (C) 1999, 2000 Rainer Wichmann */
3	/* */
4	/* This program is free software; you can redistribute it */
5	/* and/or modify */
6	/* it under the terms of the GNU General Public License as */
7	/* published by */
8	/* the Free Software Foundation; either version 2 of the License, or */
9	/* (at your option) any later version. */
10	/* */
11	/* This program is distributed in the hope that it will be useful, */
12	/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13	/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14	/* GNU General Public License for more details. */
15	/* */
16	/* You should have received a copy of the GNU General Public License */
17	/* along with this program; if not, write to the Free Software */
18	/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20	#include "config_xor.h"
21
22	#include <stdio.h>
23	#include <stdlib.h>
24
25
26	#if defined(WITH_GPG) \|\| defined(WITH_PGP)
27
28	#include <unistd.h>
29	#include <fcntl.h>
30	#include <signal.h>
31	#if defined(SH_WITH_SERVER)
32	#include <pwd.h>
33	#endif
34	#include <sys/stat.h>
35	#include <sys/types.h>
36	#include <errno.h>
37	#include <sys/wait.h>
38
39	#include <string.h>
40	#ifdef HAVE_MEMORY_H
41	#include <memory.h>
42	#endif
43
44
45	#if !defined(O_NONBLOCK)
46	#if defined(O_NDELAY)
47	#define O_NONBLOCK O_NDELAY
48	#else
49	#define O_NONBLOCK 0
50	#endif
51	#endif
52
53
54	#include "samhain.h"
55	#include "sh_utils.h"
56	#include "sh_error.h"
57	#include "sh_tiger.h"
58	#if defined(SH_WITH_SERVER)
59	#define SH_NEED_PWD_GRP 1
60	#include "sh_static.h"
61	#endif
62
63	static struct {
64	char conf_id[SH_MINIBUF+1];
65	char conf_fp[SH_MINIBUF+1];
66	char data_id[SH_MINIBUF+1];
67	char data_fp[SH_MINIBUF+1];
68	} gp;
69
70	typedef struct {
71	pid_t pid;
72	FILE * pipe;
73	} sh_gpg_popen_t;
74
75	#define SH_GPG_OK 0
76	#define SH_GPG_BAD 1
77	#define SH_GPG_BADSIGN 2
78
79	/* replace #if 0 by #if 1 and set an appropriate path in front of '/pdbg.'
80	* for debugging
81	*/
82	#if 0
83	#define PDGBFILE "/pdbg."
84	#endif
85
86	#if defined(PDGBFILE)
87	FILE * pdbg;
88	FILE * pdbgc;
89	#define PDBG_OPEN pdbg = fopen(PDGBFILE"main", "a")
90	#define PDBG_CLOSE fclose (pdbg)
91	#define PDBG(arg) fprintf(pdbg, "PDBG: step %d\n", arg); fflush(pdbg)
92	#define PDBG_D(arg) fprintf(pdbg, "PDBG: %d\n", arg); fflush(pdbg)
93	#define PDBG_S(arg) fprintf(pdbg, "PDBG: %s\n", arg); fflush(pdbg)
94
95	#define PDBGC_OPEN pdbgc = fopen(PDGBFILE"child", "a")
96	#define PDBGC_CLOSE fclose (pdbgc)
97	#define PDBGC(arg) fprintf(pdbgc, "PDBG: step %d\n", arg); fflush(pdbgc)
98	#define PDBGC_D(arg) fprintf(pdbgc, "PDBG: %d\n", arg); fflush(pdbgc)
99	#define PDBGC_S(arg) fprintf(pdbgc, "PDBG: %s\n", arg); fflush(pdbgc)
100	#else
101	#define PDBG_OPEN
102	#define PDBG_CLOSE
103	#define PDBG(arg)
104	#define PDBG_D(arg)
105	#define PDBG_S(arg)
106	#define PDBGC_OPEN
107	#define PDBGC_CLOSE
108	#define PDBGC(arg)
109	#define PDBGC_D(arg)
110	#define PDBGC_S(arg)
111	#endif
112
113	#undef FIL__
114	#define FIL__ _("sh_gpg.c")
115
116	#ifdef GPG_HASH
117
118	static int sh_gpg_checksum (SL_TICKET checkfd, int flag)
119	{
120	char * test_gpg;
121	char * test_ptr1 = NULL;
122	char * test_ptr2 = NULL;
123	char wstrip1[128];
124	char wstrip2[128];
125	int i, k;
126	#include "sh_gpg_chksum.h"
127
128	SL_ENTER(_("sh_gpg_checksum"));
129
130	tiger_fd = checkfd;
131	#if defined(WITH_PGP)
132	test_gpg = sh_tiger_hash_gpg (DEFAULT_PGP_PATH, TIGER_FD, 0);
133	#else
134	test_gpg = sh_tiger_hash_gpg (DEFAULT_GPG_PATH, TIGER_FD, 0);
135	#endif
136
137	test_ptr1 = strchr(GPG_HASH, ':');
138	if (test_gpg != NULL)
139	test_ptr2 = strchr(test_gpg, ':');
140
141	if (test_ptr2 != NULL)
142	test_ptr2 += 2;
143	else
144	test_ptr2 = test_gpg;
145	if (test_ptr1 != NULL)
146	test_ptr1 += 2;
147	else
148	test_ptr1 = GPG_HASH;
149
150	/* Tue Jun 24 23:11:54 CEST 2003 (1.7.9) -- strip whitespace
151	*/
152	k = 0;
153	for (i = 0; i < 127; ++i)
154	{
155	if (test_ptr1[i] == '\0')
156	break;
157	if (test_ptr1[i] != ' ')
158	{
159	wstrip1[k] = test_ptr1[i];
160	++k;
161	}
162	}
163	wstrip1[k] = '\0';
164
165	for(i = 0; i < KEY_LEN; ++i)
166	{
167	if (gpgchk[i] != wstrip1[i])
168	{
169	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0, MSG_E_GPG_CHK,
170	gpgchk, wstrip1);
171	break;
172	}
173	}
174
175	k = 0;
176	for (i = 0; i < 127; ++i)
177	{
178	if (test_ptr2[i] == '\0')
179	break;
180	if (test_ptr2[i] != ' ')
181	{
182	wstrip2[k] = test_ptr2[i];
183	++k;
184	}
185	}
186	wstrip2[k] = '\0';
187
188	if (0 != sl_strncmp(wstrip1, wstrip2, 127))
189	{
190	TPT(((0), FIL__, __LINE__, _("msg=<pgp checksum: %s>\n"), test_gpg));
191	TPT(((0), FIL__, __LINE__, _("msg=<Compiled-in : %s>\n"), GPG_HASH));
192	TPT(((0), FIL__, __LINE__, _("msg=<wstrip1 : %s>\n"), wstrip1));
193	TPT(((0), FIL__, __LINE__, _("msg=<wstrip2 : %s>\n"), wstrip2));
194	if (flag == 1)
195	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_GPG,
196	GPG_HASH, test_gpg);
197	dlog(1, FIL__, __LINE__, _("The compiled-in checksum of the gpg binary\n(%s)\ndoes not match the actual checksum\n(%s).\nYou need to recompile with the correct checksum."), wstrip1, wstrip2);
198	SH_FREE(test_gpg);
199	SL_RETURN((-1), _("sh_gpg_checksum"));
200	}
201	SH_FREE(test_gpg);
202	SL_RETURN( (0), _("sh_gpg_checksum"));
203	}
204	#endif
205
206	struct startup_info {
207	long line;
208	char * program;
209	long uid;
210	char * path;
211	char * key_uid;
212	char * key_id;
213	};
214
215	static struct startup_info startInfo = { 0, NULL, 0, NULL, NULL, NULL };
216
217	void sh_gpg_log_startup ()
218	{
219	if (startInfo.program != NULL)
220	{
221	sh_error_handle ((-1), FIL__, startInfo.line, 0, MSG_START_GH,
222	startInfo.program, startInfo.uid,
223	startInfo.path,
224	startInfo.key_uid, startInfo.key_id);
225	}
226	return;
227	}
228
229	static void sh_gpg_fill_startup (long line, char * program, long uid, char * path,
230	char * key_uid, char * key_id)
231	{
232	startInfo.line = line;
233	startInfo.program = sh_util_strdup(program);
234	startInfo.uid = uid;
235	startInfo.path = sh_util_strdup(path);
236	startInfo.key_uid = sh_util_strdup(key_uid);
237	startInfo.key_id = sh_util_strdup(key_id);
238	return;
239	}
240
241	static FILE * sh_gpg_popen (sh_gpg_popen_t *source, int fd,
242	int mode, char * id, char * homedir)
243	{
244	int pipedes[2];
245	FILE * outf = NULL;
246	char * envp[2];
247	size_t len;
248	char path[256];
249	char cc1[32];
250	char cc2[32];
251	#if defined(WITH_PGP)
252	char cc3[32];
253	char cc0[3] = "-f";
254	#endif
255	#if defined(WITH_GPG)
256	char cc0[2] = "-";
257	char cc3[32];
258	char cc4[SH_PATHBUF+32];
259	char cc5[32] = "--no-tty";
260	#endif
261
262	char * arg[9];
263
264	#if defined(HAVE_GPG_CHECKSUM)
265	SL_TICKET checkfd;
266	int myrand;
267	int i;
268	#if defined(__linux__)
269	int get_the_fd(SL_TICKET);
270	char pname[128];
271	int pfd;
272	#endif
273	#endif
274
275	SL_ENTER(_("sh_gpg_popen"));
276
277	#if defined(WITH_GPG)
278	/* -- GnuPG -- */
279	sl_strlcpy (path, DEFAULT_GPG_PATH, 256);
280	sl_strlcpy (cc1, _("--status-fd"), 32);
281	sl_strlcpy (cc2, _("--verify"), 32);
282	sl_strlcpy (cc3, _("--homedir"), 32);
283	/* sl_strlcpy (cc4, sh.effective.home, SH_PATHBUF+32); */
284	sl_strlcpy (cc4, homedir, SH_PATHBUF+32);
285	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
286
287	/* fprintf(stderr, "YULE: homedir=%s\n", homedir); */
288
289	#if defined(SH_WITH_SERVER)
290	if (0 == sl_ret_euid()) /* privileges not dropped yet */
291	{
292	struct stat lbuf;
293	int status_stat = 0;
294	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
295	struct passwd pwd;
296	char buffer[SH_PWBUF_SIZE];
297	struct passwd * tempres;
298	sh_getpwnam_r(DEFAULT_IDENT, &pwd, buffer, sizeof(buffer), &tempres);
299	#else
300	struct passwd * tempres = sh_getpwnam(DEFAULT_IDENT);
301	#endif
302
303	if (!tempres)
304	{
305	dlog(1, FIL__, __LINE__,
306	_("User %s does not exist. Please add the user to your system.\n"),
307	DEFAULT_IDENT);
308	status_stat = -1;
309	}
310	if (!tempres->pw_dir \|\| tempres->pw_dir[0] == '\0')
311	{
312	dlog(1, FIL__, __LINE__,
313	_("User %s does not have a home directory.\nPlease add the home directory for this user to your system.\n"),
314	DEFAULT_IDENT);
315	status_stat = -2;
316	}
317	if (status_stat == 0)
318	{
319	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
320	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
321	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
322	if (status_stat == -1)
323	{
324	dlog(1, FIL__, __LINE__,
325	_("Gnupg directory %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
326	cc4, DEFAULT_IDENT);
327	status_stat = -3;
328	}
329	}
330	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
331	{
332	dlog(1, FIL__, __LINE__,
333	_("Gnupg directory %s\nis not owned by user %s.\n"),
334	cc4, DEFAULT_IDENT);
335	status_stat = -4;
336	}
337	if (status_stat == 0)
338	{
339	sl_strlcat (cc4, _("/pubring.gpg"), SH_PATHBUF+32);
340	status_stat = retry_lstat(FIL__, __LINE__, cc4, &lbuf);
341	if (status_stat == -1)
342	{
343	dlog(1, FIL__, __LINE__,
344	_("Gnupg public keyring %s for user %s\ndoes not exist or is not accessible.\nPlease add the directory and put the keyring (pubring.gpg) there\nto verify the configuration file.\n"),
345	cc4, DEFAULT_IDENT);
346	status_stat = -5;
347	}
348	}
349	if (status_stat == 0 && lbuf.st_uid != tempres->pw_uid)
350	{
351	dlog(1, FIL__, __LINE__,
352	_("Gnupg public keyring %s\nis not owned by user %s.\n"),
353	cc4, DEFAULT_IDENT);
354	status_stat = -6;
355	}
356	if (status_stat != 0)
357	{
358	sh_error_handle((-1), FIL__, __LINE__, status_stat, MSG_EXIT_ABORT1,
359	sh.prg_name);
360	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
361	}
362	sl_strlcpy (cc4, tempres->pw_dir, SH_PATHBUF+32);
363	sl_strlcat (cc4, _("/.gnupg"), SH_PATHBUF+32);
364	}
365	#endif
366
367	arg[0] = path;
368	arg[1] = cc1;
369	arg[2] = "1";
370	arg[3] = cc2;
371	arg[4] = cc3;
372	arg[5] = cc4;
373	arg[6] = cc5;
374	arg[7] = cc0;
375	arg[8] = NULL;
376
377	/* catch 'unused parameter' compiler warning
378	*/
379	(void) mode;
380	(void) id;
381	#elif defined(WITH_PGP)
382	/* -- PGP -- */
383	sl_strlcpy (path, DEFAULT_PGP_PATH, 256);
384	if (mode == 0)
385	{
386	sl_strlcpy (cc1, _("+language=en"), 32);
387	sl_strlcpy (cc2, _("-o"), 32);
388	sl_strlcpy (cc3, _("/dev/null"), 32);
389
390	arg[0] = path;
391	arg[1] = cc1;
392	arg[2] = cc2;
393	arg[3] = cc3;
394	arg[4] = cc0;
395	arg[5] = NULL;
396	}
397	else
398	{
399	sl_strlcpy (cc1, _("+language=en"), 32);
400	sl_strlcpy (cc2, _("-kvc"), 32);
401
402	arg[0] = path;
403	arg[1] = cc1;
404	arg[2] = cc2;
405	arg[3] = id;
406	arg[4] = NULL;
407	arg[5] = NULL;
408	}
409	#endif
410
411	/* use homedir of effective user
412	*/
413	if (sh.effective.home != NULL)
414	{
415	len = sl_strlen(sh.effective.home) + 6;
416	envp[0] = malloc (len); /* free() ok */
417	if (envp[0] != NULL)
418	sl_snprintf (envp[0], len, "HOME=%s", sh.effective.home);
419	envp[1] = NULL;
420	}
421	else
422	{
423	envp[0] = NULL;
424	}
425
426	/* Create the pipe
427	*/
428	if (aud_pipe(FIL__, __LINE__, pipedes) < 0)
429	{
430	if (envp[0] != NULL)
431	free(envp[0]);
432	SL_RETURN( (NULL), _("sh_gpg_popen"));
433	}
434
435	fflush (NULL);
436
437	source->pid = aud_fork(FIL__, __LINE__);
438
439	/* Failure
440	*/
441	if (source->pid == (pid_t) - 1)
442	{
443	close(pipedes[0]);
444	close(pipedes[1]);
445	if (envp[0] != NULL)
446	free(envp[0]);
447	SL_RETURN( (NULL), _("sh_gpg_popen"));
448	}
449
450	if (source->pid == (pid_t) 0)
451	{
452
453	/* child - make read side of the pipe stdout
454	*/
455	if (retry_aud_dup2(FIL__, __LINE__,
456	pipedes[STDOUT_FILENO], STDOUT_FILENO) < 0)
457	{
458	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on pipe failed>\n")));
459	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
460	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
461	}
462
463	/* close the pipe descriptors
464	*/
465	close (pipedes[STDIN_FILENO]);
466	close (pipedes[STDOUT_FILENO]);
467
468
469	#if defined(WITH_PGP)
470	if (mode == 0)
471	{
472	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
473	{
474	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
475	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
476	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
477	}
478	}
479	#else
480	if (retry_aud_dup2(FIL__, __LINE__, fd, STDIN_FILENO) < 0)
481	{
482	TPT(((0), FIL__, __LINE__, _("msg=<dup2 on fd failed>\n")));
483	dlog(1, FIL__, __LINE__, _("Internal error: dup2 failed\n"));
484	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
485	}
486	#endif
487
488	/* don't leak file descriptors
489	*/
490	sh_unix_closeall (3, -1); /* in child process */
491
492	freopen(_("/dev/null"), "r+", stderr);
493
494	/* We should become privileged if SUID,
495	* to be able to read the keyring.
496	* We have checked that gpg is OK,
497	* AND that only a trusted user could overwrite
498	* gpg.
499	*/
500	memset (skey, '\0', sizeof(sh_key_t));
501	aud_setuid(FIL__, __LINE__, geteuid());
502
503	PDBGC_OPEN;
504	PDBGC_D((int)getuid());
505	PDBGC_D((int)geteuid());
506
507	{
508	int i = 0;
509	while (arg[i] != NULL)
510	{
511	PDBGC_S(arg[i]);
512	++i;
513	}
514	}
515	PDBGC_CLOSE;
516
517	/* exec the program */
518
519	#if defined(__linux__) && defined(HAVE_GPG_CHECKSUM)
520	/*
521	* -- emulate an fexecve with checksum testing
522	*/
523	#if defined(WITH_PGP)
524	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_NOPRIV);
525	#else
526	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_NOPRIV);
527	#endif
528
529	if (0 != sh_gpg_checksum(checkfd, 0))
530	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
531
532	pfd = get_the_fd(checkfd);
533	sl_snprintf(pname, sizeof(pname), _("/proc/self/fd/%d"), pfd);
534	if (0 == access(pname, R_OK\|X_OK)) /* flawfinder: ignore */
535
536	{
537	fcntl (pfd, F_SETFD, FD_CLOEXEC);
538	retry_aud_execve (FIL__, __LINE__, pname, arg, envp);
539
540	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
541	pname);
542	/* failed
543	*/
544	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
545	}
546
547	/* procfs not working, go ahead
548	*/
549	sl_close(checkfd);
550	#endif
551
552	#if defined(HAVE_GPG_CHECKSUM)
553	/* This is an incredibly ugly kludge to prevent an attacker
554	* from knowing when it is safe to slip in a fake executable
555	* between the integrity check and the execve
556	*/
557	myrand = (int) taus_get (&(skey->rng0[0]), &(skey->rng1[0]),
558	&(skey->rng2[0]));
559	myrand = (myrand < 0) ? (-myrand) : myrand;
560	myrand = (myrand % 32) + 2;
561
562	for (i = 0; i < myrand; ++i)
563	{
564	#if defined(WITH_PGP)
565	checkfd = sl_open_fastread(DEFAULT_PGP_PATH, SL_NOPRIV);
566	#else
567	checkfd = sl_open_fastread(DEFAULT_GPG_PATH, SL_NOPRIV);
568	#endif
569	if (0 != sh_gpg_checksum(checkfd, 0)) {
570	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
571	}
572	sl_close(checkfd);
573	}
574	#endif
575
576
577	#if defined(WITH_GPG)
578	retry_aud_execve (FIL__, __LINE__, DEFAULT_GPG_PATH, arg, envp);
579	dlog(1, FIL__, __LINE__, _("Unexpected error: execve %s failed\n"),
580	DEFAULT_GPG_PATH);
581	#elif defined(WITH_PGP)
582	retry_aud_execve (FIL__, __LINE__, DEFAULT_PGP_PATH, arg, envp);
583	#endif
584
585	/* failed
586	*/
587	TPT(((0), FIL__, __LINE__, _("msg=<execve failed>\n")));
588	dlog(1, FIL__, __LINE__, _("Unexpected error: execve failed\n"));
589	aud__exit(FIL__, __LINE__, EXIT_FAILURE);
590	}
591
592	/* parent
593	*/
594
595	if (envp[0] != NULL)
596	free(envp[0]);
597
598	close (pipedes[STDOUT_FILENO]);
599	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFD, FD_CLOEXEC);
600	retry_fcntl (FIL__, __LINE__, pipedes[STDIN_FILENO], F_SETFL, O_NONBLOCK);
601
602	outf = fdopen (pipedes[STDIN_FILENO], "r");
603
604	if (outf == NULL)
605	{
606	aud_kill (FIL__, __LINE__, source->pid, SIGKILL);
607	close (pipedes[STDOUT_FILENO]);
608	waitpid (source->pid, NULL, 0);
609	source->pid = 0;
610	SL_RETURN( (NULL), _("sh_gpg_popen"));
611	}
612
613	SL_RETURN( (outf), _("sh_gpg_popen"));
614	}
615
616
617	static int sh_gpg_pclose (sh_gpg_popen_t *source)
618	{
619	int status = 0;
620
621	SL_ENTER(_("sh_gpg_pclose"));
622
623	status = fclose(source->pipe);
624	if (status)
625	SL_RETURN( (-1), _("sh_gpg_pclose"));
626
627	if (waitpid(source->pid, NULL, 0) != source->pid)
628	status = -1;
629
630	source->pipe = NULL;
631	source->pid = 0;
632	SL_RETURN( (status), _("sh_gpg_pclose"));
633	}
634
635	static
636	int sh_gpg_check_file_sign(int fd, char * sign_id, char * sign_fp,
637	char * homedir, int whichfile)
638	{
639	struct stat buf;
640	char line[256];
641	sh_gpg_popen_t source;
642	int have_id = BAD, have_fp = BAD, status = 0;
643	#ifdef WITH_PGP
644	char *ptr;
645	#endif
646
647	#ifdef HAVE_GPG_CHECKSUM
648	SL_TICKET checkfd;
649	#endif
650
651	SL_ENTER(_("sh_gpg_check_file_sign"));
652
653	/* check whether GnuPG exists and has the correct checksum
654	*/
655	#if defined(WITH_GPG)
656
657	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
658	TPT(((0), FIL__, __LINE__, _("msg=<gpg is %s>\n"), DEFAULT_GPG_PATH));
659
660	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_GPG_PATH, &buf))
661	{
662	status = errno;
663	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
664	sh_error_message(status), DEFAULT_GPG_PATH);
665	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
666	}
667
668	if (0 != tf_trust_check (DEFAULT_GPG_PATH, SL_YESPRIV))
669	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
670
671	#ifdef HAVE_GPG_CHECKSUM
672	checkfd = sl_open_read(DEFAULT_GPG_PATH, SL_YESPRIV);
673
674	if (0 != sh_gpg_checksum(checkfd, 1))
675	{
676	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
677	_("Checksum mismatch"),
678	_("gpg_check_file_sign"));
679	sl_close(checkfd);
680	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
681	}
682	sl_close(checkfd);
683	#endif
684
685	#elif defined(WITH_PGP)
686
687	TPT(((0), FIL__, __LINE__, _("msg=<Check signature>\n")));
688	TPT(((0), FIL__, __LINE__, _("msg=<pgp is %s>\n"), DEFAULT_PGP_PATH));
689
690	if (0 != retry_lstat(FIL__, __LINE__, DEFAULT_PGP_PATH, &buf))
691	{
692	status = errno;
693	sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, status, MSG_ERR_LSTAT,
694	sh_error_message(status), DEFAULT_PGP_PATH);
695	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
696	}
697	if (0 != tf_trust_check (DEFAULT_PGP_PATH, SL_YESPRIV))
698	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
699
700	#ifdef HAVE_GPG_CHECKSUM
701	checkfd = sl_open_read(DEFAULT_PGP_PATH, SL_YESPRIV);
702
703	if (0 != sh_gpg_checksum(checkfd, 1))
704	{
705	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
706	_("Checksum mismatch"),
707	_("gpg_check_file_sign"));
708	sl_close(checkfd);
709	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
710	}
711	sl_close(checkfd);
712	#endif
713
714	#endif
715
716	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe to check signature>\n")));
717
718	fflush(NULL);
719
720	source.pipe = sh_gpg_popen ( &source, fd, 0, NULL, homedir );
721
722	if (NULL == source.pipe)
723	{
724	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
725	_("Could not open pipe"),
726	_("gpg_check_file_sign"));
727	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
728	}
729
730	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
731
732	xagain:
733
734	errno = 0;
735
736	while (NULL != fgets(line, sizeof(line), source.pipe))
737	{
738
739	TPT(((0), FIL__, __LINE__, _("msg=<gpg out: %s>\n"), line));
740	if (line[strlen(line)-1] == '\n')
741	line[strlen(line)-1] = ' ';
742	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
743	line,
744	_("gpg_check_file_sign"));
745
746	if (sl_strlen(line) < 18)
747	continue;
748	#if defined(WITH_GPG)
749	/* Sun May 27 18:40:05 CEST 2001
750	*/
751	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6) \|\|
752	0 == sl_strncmp(_("ERRSIG"), &line[9], 6) \|\|
753	0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6) \|\|
754	0 == sl_strncmp(_("NODATA"), &line[9], 6) \|\|
755	0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6))
756	{
757	if (0 == sl_strncmp(_("BADSIG"), &line[9], 6)) {
758	dlog(1, FIL__, __LINE__,
759	_("%s file is signed, but the signature is invalid."),
760	((whichfile == 1) ? _("Configuration") : _("Database")));
761	}
762	else if (0 == sl_strncmp(_("NO_PUBKEY"), &line[9], 6)) {
763	dlog(1, FIL__, __LINE__,
764	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
765	((whichfile == 1) ? _("Configuration") : _("Database")),
766	homedir);
767	}
768	else if (0 == sl_strncmp(_("ERRSIG"), &line[9], 6)) {
769	dlog(1, FIL__, __LINE__,
770	_("%s file is signed, but the public key to verify the signature is not in my keyring %s/.gnupg/pubring.asc."),
771	((whichfile == 1) ? _("Configuration") : _("Database")),
772	homedir);
773	}
774	else if (0 == sl_strncmp(_("SIGEXPIRED"), &line[9], 6)) {
775	dlog(1, FIL__, __LINE__,
776	_("%s file is signed, but the public key to verify the signature has expired."),
777	((whichfile == 1) ? _("Configuration") : _("Database")));
778	}
779	else if (0 == sl_strncmp(_("NODATA"), &line[9], 6)) {
780	dlog(1, FIL__, __LINE__,
781	_("%s file is not signed."),
782	((whichfile == 1) ? _("Configuration") : _("Database")));
783	}
784
785	have_fp = BAD; have_id = BAD;
786	break;
787	}
788	if (0 == sl_strncmp(_("GOODSIG"), &line[9], 7))
789	{
790	sl_strlcpy (sign_id, &line[25], SH_MINIBUF+1);
791	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing '"' */
792	have_id = GOOD;
793	}
794	if (0 == sl_strncmp(_("VALIDSIG"), &line[9], 8))
795	{
796	strncpy (sign_fp, &line[18], 40);
797	sign_fp[40] = '\0';
798	have_fp = GOOD;
799	}
800	#elif defined(WITH_PGP)
801	if (0 == sl_strncmp(_("Bad signature"), line, 13) \|\|
802	0 == sl_strncmp(_("Error"), line, 5) \|\|
803	0 == sl_strncmp(_("Malformed"), line, 9) \|\|
804	0 == sl_strncmp(_("WARNING"), line, 7) \|\|
805	0 == sl_strncmp(_("ERROR"), line, 5)
806	)
807	{
808	have_fp = BAD; have_id = BAD;
809	break;
810	}
811	if (0 == sl_strncmp(_("Good signature"), line, 14))
812	{
813	ptr = strchr ( line, '"');
814	++ptr;
815	sl_strlcpy (sign_id, ptr, SH_MINIBUF+1);
816	sign_id[sl_strlen(sign_id)-1] = '\0'; /* remove trailing dot */
817	sign_id[sl_strlen(sign_id)-2] = '\0'; /* remove trailing '"' */
818	have_id = GOOD;
819	}
820	#endif
821	}
822
823	if (ferror(source.pipe) && errno == EAGAIN)
824	{
825	clearerr(source.pipe);
826	goto xagain;
827	}
828
829	sh_gpg_pclose (&source);
830
831	TPT(((0), FIL__, __LINE__, _("msg=<Close pipe>\n")));
832
833	#ifdef WITH_PGP
834	/* get the fingerprint */
835
836	source.pipe = sh_gpg_popen ( &source, fd, 1, sign_id, homedir);
837	if (NULL == source.pipe)
838	{
839	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
840	_("Could not open pipe for fp"),
841	_("gpg_check_file_sign"));
842	SL_RETURN( SH_GPG_BAD, _("sh_gpg_check_file_sign"));
843	}
844
845	TPT(((0), FIL__, __LINE__, _("msg=<Open pipe success>\n")));
846
847	yagain:
848
849	errno = 0;
850
851	while (NULL != fgets(line, sizeof(line), source.pipe))
852	{
853	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
854	char * saveptr = NULL;
855	#endif
856	if (line[strlen(line)-1] == '\n')
857	line[strlen(line)-1] = ' ';
858	sh_error_handle(SH_ERR_ALL, FIL__, __LINE__, 0, MSG_E_SUBGEN,
859	line,
860	_("gpg_check_file_sign"));
861
862	if (sl_strlen(line) < 18)
863	continue;
864	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
865	ptr = strtok_r (line, " ", &saveptr);
866	#else
867	ptr = strtok (line, " ");
868	#endif
869	while (ptr)
870	{
871	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
872	ptr = strtok_r (NULL, " ", &saveptr);
873	#else
874	ptr = strtok (NULL, " ");
875	#endif
876	if (ptr && 0 == sl_strncmp (ptr, _("fingerprint"), 11))
877	{
878	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
879	ptr = strtok_r (NULL, " ", &saveptr); /* to '=' */
880	#else
881	ptr = strtok (NULL, " "); /* to '=' */
882	#endif
883	sign_fp[0] = '\0';
884	while (ptr)
885	{
886	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
887	ptr = strtok_r (NULL, " ", &saveptr); /* part of fingerprint */
888	#else
889	ptr = strtok (NULL, " "); /* part of fingerprint */
890	#endif
891	sl_strlcat (sign_fp, ptr, SH_MINIBUF+1);
892	}
893	/* sign_fp[sl_strlen(sign_fp)-1] = '\0'; remove trailing '\n' */
894	if (sl_strlen(sign_fp) > 0)
895	have_fp = GOOD;
896	break;
897	}
898	}
899	}
900
901	if (ferror(source.pipe) && errno == EAGAIN)
902	{
903	clearerr(source.pipe);
904	goto yagain;
905	}
906
907	sh_gpg_pclose (&source);
908	#endif
909
910	if (have_id == GOOD)
911	{
912	TPT(((0), FIL__, __LINE__, _("msg=<Got signator ID>\n")));
913	;
914	}
915	if (have_fp == GOOD)
916	{
917	TPT(((0), FIL__, __LINE__, _("msg=<Got fingerprint>\n")));
918	;
919	}
920
921	if (have_id == GOOD && have_fp == GOOD)
922	SL_RETURN( SH_GPG_OK, _("sh_gpg_check_file_sign"));
923	else
924	{
925	if (have_id == BAD)
926	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
927	_("No good signature"),
928	_("gpg_check_file_sign"));
929	else
930	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
931	_("No fingerprint for key"),
932	_("gpg_check_file_sign"));
933	SL_RETURN( SH_GPG_BADSIGN, _("sh_gpg_check_file_sign"));
934	}
935	}
936
937	int get_the_fd(SL_TICKET file_1);
938
939	int sh_gpg_check_sign (long file_1, long file_2, int what)
940	{
941	int status = SH_GPG_BAD;
942	int fd1 = 0;
943	int fd2 = 0;
944	static int smsg = S_FALSE;
945	char * tmp;
946	char * tmp2;
947
948	char * homedir = sh.effective.home;
949	#if defined(SH_WITH_SERVER)
950	struct passwd * tempres;
951	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
952	struct passwd pwd;
953	char buffer[SH_PWBUF_SIZE];
954	#endif
955	#endif
956
957	#ifdef USE_FINGERPRINT
958	#include "sh_gpg_fp.h"
959	#endif
960
961	SL_ENTER(_("sh_gpg_check_sign"));
962
963
964	if (what == 0 \|\| what == 1)
965	fd1 = get_the_fd(file_1);
966	if (what == 0 \|\| what == 2)
967	fd2 = get_the_fd(file_2);
968
969
970	if (fd1 < 0 \|\| fd2 < 0)
971	{
972	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
973	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
974	dlog(1, FIL__, __LINE__,
975	_("This looks like an unexpected internal error.\n"));
976	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_EXIT_ABORT1, sh.prg_name);
977	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
978	SL_RETURN( (-1), _("sh_gpg_check_sign"));
979	}
980
981	if (what == 0 \|\| what == 1)
982	{
983	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD1 = %d>\n"), fd1));
984	#if defined(SH_WITH_SERVER)
985	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
986	sh_getpwnam_r(DEFAULT_IDENT, &pwd, buffer, sizeof(buffer), &tempres);
987	#else
988	tempres = sh_getpwnam(DEFAULT_IDENT);
989	#endif
990
991	if ((tempres != NULL) && (0 == sl_ret_euid()))
992	{
993	/* privileges not dropped yet*/
994	homedir = tempres->pw_dir;
995	}
996	#endif
997	status = sh_gpg_check_file_sign(fd1, gp.conf_id, gp.conf_fp, homedir, 1);
998	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGUSR: \|%s\|>\n"), gp.conf_id));
999	TPT(((0), FIL__, __LINE__, _("msg=<CONF SIGFP: \|%s\|>\n"), gp.conf_fp));
1000	}
1001
1002	if ((what == 0 && SH_GPG_OK == status) \|\| what == 2)
1003	{
1004	TPT(((0), FIL__, __LINE__, _("msg=<GPG_CHECK: FD2 = %d>\n"), fd2));
1005	#if defined(SH_WITH_SERVER)
1006	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1007	sh_getpwnam_r(DEFAULT_IDENT, &pwd, buffer, sizeof(buffer), &tempres);
1008	#else
1009	tempres = sh_getpwnam(DEFAULT_IDENT);
1010	#endif
1011
1012	if ((tempres != NULL) && (0 == sl_ret_euid()))
1013	{
1014	/* privileges not dropped yet*/
1015	homedir = tempres->pw_dir;
1016	}
1017	#endif
1018	status = sh_gpg_check_file_sign(fd2, gp.data_id, gp.data_fp, homedir, 2);
1019	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGUSR: \|%s\|>\n"), gp.data_id));
1020	TPT(((0), FIL__, __LINE__, _("msg=<DATA SIGFP: \|%s\|>\n"), gp.data_fp));
1021	}
1022
1023	if (SH_GPG_OK == status && what == 1)
1024	{
1025	#ifdef USE_FINGERPRINT
1026	if ((sl_strcmp(SH_GPG_FP, gp.conf_fp) == 0))
1027	{
1028	int i;
1029
1030	for(i = 0; i < (int) sl_strlen(gp.conf_fp); ++i)
1031	{
1032	if (gpgfp[i] != gp.conf_fp[i])
1033	{
1034	sh_error_handle(SH_ERR_SEVERE, FIL__, __LINE__, 0,
1035	MSG_E_GPG_FP,
1036	gpgfp, gp.conf_fp);
1037	break;
1038	}
1039	}
1040
1041	if (smsg == S_FALSE)
1042	{
1043	tmp = sh_util_safe_name(gp.conf_id);
1044	sh_gpg_fill_startup (__LINE__,
1045	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1046	sh.prg_name, sh.real.uid,
1047	(sh.flag.hidefile == S_TRUE) ?
1048	_("(hidden)") : file_path('C', 'R'),
1049	tmp,
1050	gp.conf_fp);
1051	SH_FREE(tmp);
1052	}
1053	smsg = S_TRUE;
1054	SL_RETURN(0, _("sh_gpg_check_sign"));
1055	}
1056	else
1057	{
1058	/* fp mismatch
1059	*/
1060	dlog(1, FIL__, __LINE__,
1061	_("The fingerprint of the signing key: %s\ndoes not match the compiled-in fingerprint: %s.\nTherefore the signature could not be verified.\n"),
1062	gp.conf_fp, SH_GPG_FP);
1063	sh_error_handle((-1), FIL__, __LINE__, 0, MSG_E_SUBGEN,
1064	_("Fingerprint mismatch"),
1065	_("gpg_check_sign"));
1066	status = SH_GPG_BADSIGN;
1067	}
1068	#else
1069	if (smsg == S_FALSE)
1070	{
1071	tmp = sh_util_safe_name(gp.conf_id);
1072	sh_gpg_fill_startup (__LINE__,
1073	/* sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH, */
1074	sh.prg_name, sh.real.uid,
1075	(sh.flag.hidefile == S_TRUE) ?
1076	_("(hidden)") : file_path('C', 'R'),
1077	tmp,
1078	gp.conf_fp);
1079	SH_FREE(tmp);
1080	}
1081	smsg = S_TRUE;
1082	SL_RETURN(0, _("sh_gpg_check_sign"));
1083	#endif
1084	}
1085
1086	else if (SH_GPG_OK == status && (what == 2 \|\| what == 0))
1087	{
1088	if ((sl_strcmp(gp.data_id, gp.conf_id) == 0) &&
1089	(sl_strcmp(gp.data_fp, gp.conf_fp) == 0))
1090	{
1091	SL_RETURN(0, _("sh_gpg_check_sign"));
1092	}
1093	else
1094	{
1095	/* ID or fp not equal
1096	*/
1097	dlog(1, FIL__, __LINE__,
1098	_("The fingerprint or ID of the signing key is not the same for the\nconfiguration file and the file signature database.\nTherefore the signature could not be verified.\n"));
1099	tmp = sh_util_safe_name (gp.conf_id);
1100	tmp2 = sh_util_safe_name (gp.data_id);
1101	sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_START_GH2,
1102	sh.prg_name, sh.real.uid,
1103	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('C', 'R'),
1104	tmp, gp.conf_fp,
1105	(sh.flag.hidefile == S_TRUE) ? _("(hidden)") : file_path('D', 'R'),
1106	tmp2, gp.data_fp);
1107	SH_FREE(tmp);
1108	SH_FREE(tmp2);
1109	}
1110	}
1111
1112	if (status != SH_GPG_OK)
1113	{
1114	uid_t e_uid = sl_ret_euid();
1115	char * e_home = sh.effective.home;
1116
1117	#if defined(SH_WITH_SERVER)
1118	#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1119	struct passwd e_pwd;
1120	char e_buffer[SH_PWBUF_SIZE];
1121	struct passwd * e_tempres;
1122	sh_getpwnam_r(DEFAULT_IDENT, &e_pwd, e_buffer, sizeof(e_buffer), &e_tempres);
1123	#else
1124	struct passwd * e_tempres = sh_getpwnam(DEFAULT_IDENT);
1125	#endif
1126
1127	if ((e_tempres != NULL) && (0 == sl_ret_euid()))
1128	{
1129	/* privileges not dropped yet */
1130	e_uid = e_tempres->pw_uid;
1131	e_home = e_tempres->pw_dir;
1132	}
1133	#endif
1134	dlog(1, FIL__, __LINE__,
1135	_("The signature of the configuration file or the file signature database\ncould not be verified. Possible reasons are:\n - gpg binary (%s) not found\n - invalid signature\n - the signature key is not in the private keyring of UID %d,\n - there is no keyring in %s/.gnupg, or\n - the file is not signed - did you move /filename.asc to /filename ?\nTo create a signed file, use (remove old signatures before):\n gpg -a --clearsign --not-dash-escaped FILE\n mv FILE.asc FILE\n"),
1136	#if defined(WITH_GPG)
1137	DEFAULT_GPG_PATH,
1138	#else
1139	DEFAULT_PGP_PATH,
1140	#endif
1141	(int) e_uid, e_home);
1142	}
1143
1144	TPT(((0), FIL__, __LINE__, _("msg=<Status = %d>\n"), status));
1145
1146	sh_error_handle((-1), FIL__, __LINE__, status, MSG_EXIT_ABORT1, sh.prg_name);
1147	aud_exit (FIL__, __LINE__, EXIT_FAILURE);
1148
1149	return (-1); /* make compiler happy */
1150	}
1151
1152	/* #ifdef WITH_GPG */
1153	#endif
1154
1155
1156
1157
1158
1159
1160
1161

Note: See TracBrowser for help on using the repository browser.

Download in other formats: